| @@ -46,12 +46,8 @@ | ||
| 46 | 46 | if (!$this->verifyNonce()) { |
| 47 | 47 | wp_die(esc_html__('Security check failed. Please refresh and try again.', 'fluent-booking'), 403); |
| 48 | 48 | } |
| 49 | 49 | |
| 50 | - if (!PermissionManager::hasAllCalendarAccess()) { | |
| 51 | - die(esc_html__('You do not have permission to export data', 'fluent-booking')); | |
| 52 | - } | |
| 53 | - | |
| 54 | 50 | $groupId = isset($_REQUEST['group_id']) ? (int)$_REQUEST['group_id'] : null; // phpcs:ignore WordPress.Security.NonceVerification.Recommended |
| 55 | 51 | |
| 56 | 52 | if (!$groupId) { |
| 57 | 53 | die(esc_html__('Please provide Group ID', 'fluent-booking')); |
| @@ -58,8 +54,16 @@ | ||
| 58 | 54 | } |
| 59 | 55 | |
| 60 | 56 | $attendees = Booking::where('group_id', $groupId)->get(); |
| 61 | 57 | |
| 58 | + if ($attendees->isEmpty()) { | |
| 59 | + die(esc_html__('No bookings found for the provided Group ID', 'fluent-booking')); | |
| 60 | + } | |
| 61 | + | |
| 62 | + if (!PermissionManager::userCanSeeAllBookings() && !$attendees->first()->hasBookingAccess()) { | |
| 63 | + die(esc_html__('You do not have permission to export this group\'s attendees', 'fluent-booking')); | |
| 64 | + } | |
| 65 | + | |
| 62 | 66 | $csvData[] = [ |
| 63 | 67 | 'First Name', |
| 64 | 68 | 'Last Name', |
| 65 | 69 | 'Email', |
| @@ -194,10 +198,9 @@ | ||
| 194 | 198 | ]; |
| 195 | 199 | } |
| 196 | 200 | |
| 197 | 201 | /** |
| 198 | - * Sanitize a value for safe CSV output: neutralize formula injection and strip control chars. | |
| 199 | - * Prefix with single quote when value starts with =, +, -, or @ so spreadsheets treat as text. | |
| 202 | + * Make a value safe for CSV: strip control chars and neutralize formula injection. | |
| 200 | 203 | * |
| 201 | 204 | * @param mixed $value Cell value (string, number, or null). |
| 202 | 205 | * @return string Safe string for fputcsv. |
| 203 | 206 | */ |
